"Lazarus, come out": reprogramming dormant neurons to implant backdoors in AI agents

Microsoft Research researchers have found a weight-space backdoor technique called Lazarus: rewriting fewer than 10 dormant neurons in a large language model can implant a backdoor into AI agents built on that model without any training. The backdoored model passes standard evaluations and behaves normally until a trigger condition occurs, for example when the clock crosses midnight into 2027, at which point the agent outputs, in ordinary tasks, commands to download and run attacker code, and executes them with the permissions it has been granted. The method requires only inference-level compute, and chaining multiple rewritten neurons can inject arbitrary payloads at the terminal; the attack requires only write access to the weight checkpoint, and internally developed models are equally exposed. The researchers say frontier agents can detect anomalous weight modifications when asked to check, but reliable detection requires comparison with the original unmodified weights, making model provenance and weight integrity critical; Microsoft Foundry already provides protection by verifying model provenance and scanning the runtime environment, and plans to develop agent weight scanning, red-teaming tools, and model signing with tamper-evident auditing.